prometheus28.16.0

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

gRPC-Go has an authorization bypass via missing leading slash in :path

Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto vulnerable to infinite loop on large channel writes

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

github.com/buger/jsonparser has a denial of service vulnerability

golang.org/x/crypto doesn't enforce invoking key constraints

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

Prometheus Azure AD remote write OAuth client secret exposed via config API

Memory exhaustion in query parameter parsing in net/url

Moby has an Off-by-one error in its plugin privilege validation

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Go Net HTML parser is vulnerable to denial of service

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

Docker: `PUT /containers/{id}/archive` executes container binary on the host

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Quadratic string concatentation in consumeComment in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Unexpected session resumption in crypto/tls

Incorrect parsing of IPv6 host literals in net/url

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Excessive CPU consumption when building archive index in archive/zip

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Unexpected work during chain building in crypto/x509

Docker: Race condition in docker cp allows bind mount redirection to host path

Inefficient candidate hostname parsing in crypto/x509

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Enforce maximum recursion depth in encoding/asn1

Add recursion depth guard during decode in encoding/xml

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http